From 89236992913fbd704e4c68f663d7c13528702a3c Mon Sep 17 00:00:00 2001 From: =?utf8?q?Marc-Andr=C3=A9=20Lureau?= Date: Wed, 26 Feb 2020 16:24:30 +0100 Subject: [PATCH] OvmfPkg: detect TPM 1.2 in Tcg2ConfigPei MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit Complement commit 6cf1880fb5b ("OvmfPkg: add customized Tcg2ConfigPei clone", 2018-03-09) by detecting TPM 1.2 devices. Since Tpm12RequestUseTpm() returns success on any TPM interface, (including FIFO & CRB which are TPM 2.0), try to send a GetTicks TPM 1.2 command to probe the version. In case of failure, fallback on TPM 2.0 path. Signed-off-by: Marc-André Lureau Reviewed-by: Laszlo Ersek Reviewed-by: Stefan Berger Message-Id: <20200226152433.1295789-3-marcandre.lureau@redhat.com> Tested-by: Simon Hardy --- OvmfPkg/OvmfPkgIa32.dsc | 2 + OvmfPkg/OvmfPkgIa32X64.dsc | 2 + OvmfPkg/OvmfPkgX64.dsc | 2 + OvmfPkg/Tcg/Tcg2Config/Tcg2ConfigPei.inf | 3 + OvmfPkg/Tcg/Tcg2Config/Tcg2ConfigPeim.c | 82 +++++++++++++++++++----- 5 files changed, 76 insertions(+), 15 deletions(-) diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc index 71a157aad3..023061ff57 100644 --- a/OvmfPkg/OvmfPkgIa32.dsc +++ b/OvmfPkg/OvmfPkgIa32.dsc @@ -207,6 +207,7 @@ XenPlatformLib|OvmfPkg/Library/XenPlatformLib/XenPlatformLib.inf !if $(TPM_ENABLE) == TRUE + Tpm12CommandLib|SecurityPkg/Library/Tpm12CommandLib/Tpm12CommandLib.inf Tpm2CommandLib|SecurityPkg/Library/Tpm2CommandLib/Tpm2CommandLib.inf Tcg2PhysicalPresenceLib|OvmfPkg/Library/Tcg2PhysicalPresenceLibQemu/DxeTcg2PhysicalPresenceLib.inf Tcg2PpVendorLib|SecurityPkg/Library/Tcg2PpVendorLibNull/Tcg2PpVendorLibNull.inf @@ -282,6 +283,7 @@ !if $(TPM_ENABLE) == TRUE BaseCryptLib|CryptoPkg/Library/BaseCryptLib/PeiCryptLib.inf + Tpm12DeviceLib|SecurityPkg/Library/Tpm12DeviceLibDTpm/Tpm12DeviceLibDTpm.inf Tpm2DeviceLib|SecurityPkg/Library/Tpm2DeviceLibDTpm/Tpm2DeviceLibDTpm.inf !endif diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc index cb8a15ee61..5a132de7e3 100644 --- a/OvmfPkg/OvmfPkgIa32X64.dsc +++ b/OvmfPkg/OvmfPkgIa32X64.dsc @@ -211,6 +211,7 @@ XenPlatformLib|OvmfPkg/Library/XenPlatformLib/XenPlatformLib.inf !if $(TPM_ENABLE) == TRUE + Tpm12CommandLib|SecurityPkg/Library/Tpm12CommandLib/Tpm12CommandLib.inf Tpm2CommandLib|SecurityPkg/Library/Tpm2CommandLib/Tpm2CommandLib.inf Tcg2PhysicalPresenceLib|OvmfPkg/Library/Tcg2PhysicalPresenceLibQemu/DxeTcg2PhysicalPresenceLib.inf Tcg2PpVendorLib|SecurityPkg/Library/Tcg2PpVendorLibNull/Tcg2PpVendorLibNull.inf @@ -286,6 +287,7 @@ !if $(TPM_ENABLE) == TRUE BaseCryptLib|CryptoPkg/Library/BaseCryptLib/PeiCryptLib.inf + Tpm12DeviceLib|SecurityPkg/Library/Tpm12DeviceLibDTpm/Tpm12DeviceLibDTpm.inf Tpm2DeviceLib|SecurityPkg/Library/Tpm2DeviceLibDTpm/Tpm2DeviceLibDTpm.inf !endif diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc index bdfd30d535..fb6c2205e3 100644 --- a/OvmfPkg/OvmfPkgX64.dsc +++ b/OvmfPkg/OvmfPkgX64.dsc @@ -211,6 +211,7 @@ XenPlatformLib|OvmfPkg/Library/XenPlatformLib/XenPlatformLib.inf !if $(TPM_ENABLE) == TRUE + Tpm12CommandLib|SecurityPkg/Library/Tpm12CommandLib/Tpm12CommandLib.inf Tpm2CommandLib|SecurityPkg/Library/Tpm2CommandLib/Tpm2CommandLib.inf Tcg2PhysicalPresenceLib|OvmfPkg/Library/Tcg2PhysicalPresenceLibQemu/DxeTcg2PhysicalPresenceLib.inf Tcg2PpVendorLib|SecurityPkg/Library/Tcg2PpVendorLibNull/Tcg2PpVendorLibNull.inf @@ -286,6 +287,7 @@ !if $(TPM_ENABLE) == TRUE BaseCryptLib|CryptoPkg/Library/BaseCryptLib/PeiCryptLib.inf + Tpm12DeviceLib|SecurityPkg/Library/Tpm12DeviceLibDTpm/Tpm12DeviceLibDTpm.inf Tpm2DeviceLib|SecurityPkg/Library/Tpm2DeviceLibDTpm/Tpm2DeviceLibDTpm.inf !endif diff --git a/OvmfPkg/Tcg/Tcg2Config/Tcg2ConfigPei.inf b/OvmfPkg/Tcg/Tcg2Config/Tcg2ConfigPei.inf index 55684ba045..97c529c91d 100644 --- a/OvmfPkg/Tcg/Tcg2Config/Tcg2ConfigPei.inf +++ b/OvmfPkg/Tcg/Tcg2Config/Tcg2ConfigPei.inf @@ -32,11 +32,14 @@ PeimEntryPoint DebugLib PeiServicesLib + Tpm12CommandLib + Tpm12DeviceLib Tpm2DeviceLib [Guids] gEfiTpmDeviceSelectedGuid ## PRODUCES ## GUID # Used as a PPI GUID gEfiTpmDeviceInstanceTpm20DtpmGuid ## SOMETIMES_CONSUMES + gEfiTpmDeviceInstanceTpm12Guid ## SOMETIMES_CONSUMES [Ppis] gPeiTpmInitializationDonePpiGuid ## SOMETIMES_PRODUCES diff --git a/OvmfPkg/Tcg/Tcg2Config/Tcg2ConfigPeim.c b/OvmfPkg/Tcg/Tcg2Config/Tcg2ConfigPeim.c index 99d571d9fa..5b5075bded 100644 --- a/OvmfPkg/Tcg/Tcg2Config/Tcg2ConfigPeim.c +++ b/OvmfPkg/Tcg/Tcg2Config/Tcg2ConfigPeim.c @@ -18,6 +18,8 @@ #include #include #include +#include +#include #include STATIC CONST EFI_PEI_PPI_DESCRIPTOR mTpmSelectedPpi = { @@ -32,6 +34,44 @@ STATIC CONST EFI_PEI_PPI_DESCRIPTOR mTpmInitializationDonePpiList = { NULL }; +#pragma pack (1) + +typedef struct { + TPM_RSP_COMMAND_HDR Hdr; + TPM_CURRENT_TICKS CurrentTicks; +} TPM_RSP_GET_TICKS; + +#pragma pack () + +/** + Probe for the TPM for 1.2 version, by sending TPM1.2 GetTicks + + Sending a TPM1.2 command to a TPM2 should return a TPM1.2 + header (tag = 0xc4) and error code (TPM_BADTAG = 0x1e) +**/ +static +EFI_STATUS +TestTpm12 ( + ) +{ + EFI_STATUS Status; + TPM_RQU_COMMAND_HDR Command; + TPM_RSP_GET_TICKS Response; + UINT32 Length; + + Command.tag = SwapBytes16 (TPM_TAG_RQU_COMMAND); + Command.paramSize = SwapBytes32 (sizeof (Command)); + Command.ordinal = SwapBytes32 (TPM_ORD_GetTicks); + + Length = sizeof (Response); + Status = Tpm12SubmitCommand (sizeof (Command), (UINT8 *)&Command, &Length, (UINT8 *)&Response); + if (EFI_ERROR (Status)) { + return Status; + } + + return EFI_SUCCESS; +} + /** The entry point for Tcg2 configuration driver. @@ -50,27 +90,39 @@ Tcg2ConfigPeimEntryPoint ( DEBUG ((DEBUG_INFO, "%a\n", __FUNCTION__)); - Status = Tpm2RequestUseTpm (); - if (!EFI_ERROR (Status)) { - DEBUG ((DEBUG_INFO, "%a: TPM2 detected\n", __FUNCTION__)); - Size = sizeof (gEfiTpmDeviceInstanceTpm20DtpmGuid); + Status = Tpm12RequestUseTpm (); + if (!EFI_ERROR (Status) && !EFI_ERROR (TestTpm12 ())) { + DEBUG ((DEBUG_INFO, "%a: TPM1.2 detected\n", __FUNCTION__)); + Size = sizeof (gEfiTpmDeviceInstanceTpm12Guid); Status = PcdSetPtrS ( PcdTpmInstanceGuid, &Size, - &gEfiTpmDeviceInstanceTpm20DtpmGuid + &gEfiTpmDeviceInstanceTpm12Guid ); ASSERT_EFI_ERROR (Status); } else { - DEBUG ((DEBUG_INFO, "%a: no TPM2 detected\n", __FUNCTION__)); - // - // If no TPM2 was detected, we still need to install - // TpmInitializationDonePpi. Namely, Tcg2Pei will exit early upon seeing - // the default (all-bits-zero) contents of PcdTpmInstanceGuid, thus we have - // to install the PPI in its place, in order to unblock any dependent - // PEIMs. - // - Status = PeiServicesInstallPpi (&mTpmInitializationDonePpiList); - ASSERT_EFI_ERROR (Status); + Status = Tpm2RequestUseTpm (); + if (!EFI_ERROR (Status)) { + DEBUG ((DEBUG_INFO, "%a: TPM2 detected\n", __FUNCTION__)); + Size = sizeof (gEfiTpmDeviceInstanceTpm20DtpmGuid); + Status = PcdSetPtrS ( + PcdTpmInstanceGuid, + &Size, + &gEfiTpmDeviceInstanceTpm20DtpmGuid + ); + ASSERT_EFI_ERROR (Status); + } else { + DEBUG ((DEBUG_INFO, "%a: no TPM detected\n", __FUNCTION__)); + // + // If no TPM2 was detected, we still need to install + // TpmInitializationDonePpi. Namely, Tcg2Pei will exit early upon seeing + // the default (all-bits-zero) contents of PcdTpmInstanceGuid, thus we have + // to install the PPI in its place, in order to unblock any dependent + // PEIMs. + // + Status = PeiServicesInstallPpi (&mTpmInitializationDonePpiList); + ASSERT_EFI_ERROR (Status); + } } // -- 2.39.2